Cyber Incident Victim: Policía de Seguridad Aeroportuaria
Date:
Nov 2025
Location:
Argentina
Summary
Hackers compromised the payroll system of Argentina's airport security police, gaining access to employee records and making fraudulent deductions ranging from 2,000 to 5,000 pesos under labels such as “DD mayor” and “DD seguros”. The breach occurred through a vulnerability in Banco Nación, the bank that processes the agency’s payroll, and may have involved external or internal actors. In response, the organization blocked some services and launched an internal cybersecurity awareness campaign, though the attack’s motivation and the total amount taken have not been disclosed.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Hackers reportedly compromised Argentina’s airport security payroll system affecting the Policía de Seguridad Aeroportuaria (PSA). The unknown threat actor gained access to PSA’s payroll records and deducted small amounts of money from employees' salaries. The fraudulent deductions ranged from 2,000 to 5,000 pesos, equivalent to approximately $100 to $245. These deductions were listed under false labels such as “DD mayor” and “DD seguros.” According to local media sources, the attackers entered the system through a vulnerability in Banco Nación, the bank that processes the agency’s payroll. The operation could have been carried out either from abroad or from within Argentina, potentially with internal accomplices. Neither Argentina’s airport security forces nor Banco Nación have commented on these claims or publicly acknowledged the breach.
In response to the incident, the PSA blocked some of its services and launched an internal cybersecurity awareness campaign. It remains unclear whether the attack was financially or politically motivated. The total amount of stolen funds has not been disclosed in the reports.
The article also notes that in December unknown hackers breached two of Argentina’s e‑government platforms, the Mi Argentina app and the SUBE app, exposing personal information of millions of citizens. Local cyber authorities attributed that December incident to a threat actor using the pseudonym "h4xx0r1337". In July, Telecom Argentina reported being targeted by a ransomware attack that encrypted up to 18,000 workstations after hackers used stolen admin credentials. In April, hackers claimed to have obtained access to a database at the Central Bank of Argentina containing the names and ID numbers of its customers.